| /* SPDX-License-Identifier: GPL-2.0 */ |
| #ifndef __KVM_X86_MMU_INTERNAL_H |
| #define __KVM_X86_MMU_INTERNAL_H |
| |
| #include <linux/types.h> |
| #include <linux/kvm_host.h> |
| #include <asm/kvm_host.h> |
| |
| #ifdef CONFIG_KVM_PROVE_MMU |
| #define KVM_MMU_WARN_ON(x) WARN_ON_ONCE(x) |
| #else |
| #define KVM_MMU_WARN_ON(x) BUILD_BUG_ON_INVALID(x) |
| #endif |
| |
| /* Page table builder macros common to shadow (host) PTEs and guest PTEs. */ |
| #define __PT_LEVEL_SHIFT(level, bits_per_level) \ |
| (PAGE_SHIFT + ((level) - 1) * (bits_per_level)) |
| #define __PT_INDEX(address, level, bits_per_level) \ |
| (((address) >> __PT_LEVEL_SHIFT(level, bits_per_level)) & ((1 << (bits_per_level)) - 1)) |
| |
| #define __PT_LVL_ADDR_MASK(base_addr_mask, level, bits_per_level) \ |
| ((base_addr_mask) & ~((1ULL << (PAGE_SHIFT + (((level) - 1) * (bits_per_level)))) - 1)) |
| |
| #define __PT_LVL_OFFSET_MASK(base_addr_mask, level, bits_per_level) \ |
| ((base_addr_mask) & ((1ULL << (PAGE_SHIFT + (((level) - 1) * (bits_per_level)))) - 1)) |
| |
| #define __PT_ENT_PER_PAGE(bits_per_level) (1 << (bits_per_level)) |
| |
| /* |
| * Unlike regular MMU roots, PAE "roots", a.k.a. PDPTEs/PDPTRs, have a PRESENT |
| * bit, and thus are guaranteed to be non-zero when valid. And, when a guest |
| * PDPTR is !PRESENT, its corresponding PAE root cannot be set to INVALID_PAGE, |
| * as the CPU would treat that as PRESENT PDPTR with reserved bits set. Use |
| * '0' instead of INVALID_PAGE to indicate an invalid PAE root. |
| */ |
| #define INVALID_PAE_ROOT 0 |
| #define IS_VALID_PAE_ROOT(x) (!!(x)) |
| |
| static inline hpa_t kvm_mmu_get_dummy_root(void) |
| { |
| return my_zero_pfn(0) << PAGE_SHIFT; |
| } |
| |
| static inline bool kvm_mmu_is_dummy_root(hpa_t shadow_page) |
| { |
| return is_zero_pfn(shadow_page >> PAGE_SHIFT); |
| } |
| |
| typedef u64 __rcu *tdp_ptep_t; |
| |
| struct kvm_mmu_page { |
| /* |
| * Note, "link" through "spt" fit in a single 64 byte cache line on |
| * 64-bit kernels, keep it that way unless there's a reason not to. |
| */ |
| struct list_head link; |
| struct hlist_node hash_link; |
| |
| bool tdp_mmu_page; |
| bool unsync; |
| union { |
| u8 mmu_valid_gen; |
| |
| /* Only accessed under slots_lock. */ |
| bool tdp_mmu_scheduled_root_to_zap; |
| }; |
| |
| /* |
| * The shadow page can't be replaced by an equivalent huge page |
| * because it is being used to map an executable page in the guest |
| * and the NX huge page mitigation is enabled. |
| */ |
| bool nx_huge_page_disallowed; |
| |
| /* |
| * The following two entries are used to key the shadow page in the |
| * hash table. |
| */ |
| union kvm_mmu_page_role role; |
| gfn_t gfn; |
| |
| u64 *spt; |
| |
| /* |
| * Stores the result of the guest translation being shadowed by each |
| * SPTE. KVM shadows two types of guest translations: nGPA -> GPA |
| * (shadow EPT/NPT) and GVA -> GPA (traditional shadow paging). In both |
| * cases the result of the translation is a GPA and a set of access |
| * constraints. |
| * |
| * The GFN is stored in the upper bits (PAGE_SHIFT) and the shadowed |
| * access permissions are stored in the lower bits. Note, for |
| * convenience and uniformity across guests, the access permissions are |
| * stored in KVM format (e.g. ACC_EXEC_MASK) not the raw guest format. |
| */ |
| u64 *shadowed_translation; |
| |
| /* Currently serving as active root */ |
| union { |
| int root_count; |
| refcount_t tdp_mmu_root_count; |
| }; |
| unsigned int unsync_children; |
| union { |
| struct kvm_rmap_head parent_ptes; /* rmap pointers to parent sptes */ |
| tdp_ptep_t ptep; |
| }; |
| DECLARE_BITMAP(unsync_child_bitmap, 512); |
| |
| /* |
| * Tracks shadow pages that, if zapped, would allow KVM to create an NX |
| * huge page. A shadow page will have nx_huge_page_disallowed set but |
| * not be on the list if a huge page is disallowed for other reasons, |
| * e.g. because KVM is shadowing a PTE at the same gfn, the memslot |
| * isn't properly aligned, etc... |
| */ |
| struct list_head possible_nx_huge_page_link; |
| #ifdef CONFIG_X86_32 |
| /* |
| * Used out of the mmu-lock to avoid reading spte values while an |
| * update is in progress; see the comments in __get_spte_lockless(). |
| */ |
| int clear_spte_count; |
| #endif |
| |
| /* Number of writes since the last time traversal visited this page. */ |
| atomic_t write_flooding_count; |
| |
| #ifdef CONFIG_X86_64 |
| /* Used for freeing the page asynchronously if it is a TDP MMU page. */ |
| struct rcu_head rcu_head; |
| #endif |
| }; |
| |
| extern struct kmem_cache *mmu_page_header_cache; |
| |
| static inline int kvm_mmu_role_as_id(union kvm_mmu_page_role role) |
| { |
| return role.smm ? 1 : 0; |
| } |
| |
| static inline int kvm_mmu_page_as_id(struct kvm_mmu_page *sp) |
| { |
| return kvm_mmu_role_as_id(sp->role); |
| } |
| |
| static inline bool kvm_mmu_page_ad_need_write_protect(struct kvm_mmu_page *sp) |
| { |
| /* |
| * When using the EPT page-modification log, the GPAs in the CPU dirty |
| * log would come from L2 rather than L1. Therefore, we need to rely |
| * on write protection to record dirty pages, which bypasses PML, since |
| * writes now result in a vmexit. Note, the check on CPU dirty logging |
| * being enabled is mandatory as the bits used to denote WP-only SPTEs |
| * are reserved for PAE paging (32-bit KVM). |
| */ |
| return kvm_x86_ops.cpu_dirty_log_size && sp->role.guest_mode; |
| } |
| |
| static inline gfn_t gfn_round_for_level(gfn_t gfn, int level) |
| { |
| return gfn & -KVM_PAGES_PER_HPAGE(level); |
| } |
| |
| int mmu_try_to_unsync_pages(struct kvm *kvm, const struct kvm_memory_slot *slot, |
| gfn_t gfn, bool can_unsync, bool prefetch); |
| |
| void kvm_mmu_gfn_disallow_lpage(const struct kvm_memory_slot *slot, gfn_t gfn); |
| void kvm_mmu_gfn_allow_lpage(const struct kvm_memory_slot *slot, gfn_t gfn); |
| bool kvm_mmu_slot_gfn_write_protect(struct kvm *kvm, |
| struct kvm_memory_slot *slot, u64 gfn, |
| int min_level); |
| |
| /* Flush the given page (huge or not) of guest memory. */ |
| static inline void kvm_flush_remote_tlbs_gfn(struct kvm *kvm, gfn_t gfn, int level) |
| { |
| kvm_flush_remote_tlbs_range(kvm, gfn_round_for_level(gfn, level), |
| KVM_PAGES_PER_HPAGE(level)); |
| } |
| |
| unsigned int pte_list_count(struct kvm_rmap_head *rmap_head); |
| |
| extern int nx_huge_pages; |
| static inline bool is_nx_huge_page_enabled(struct kvm *kvm) |
| { |
| return READ_ONCE(nx_huge_pages) && !kvm->arch.disable_nx_huge_pages; |
| } |
| |
| struct kvm_page_fault { |
| /* arguments to kvm_mmu_do_page_fault. */ |
| const gpa_t addr; |
| const u32 error_code; |
| const bool prefetch; |
| |
| /* Derived from error_code. */ |
| const bool exec; |
| const bool write; |
| const bool present; |
| const bool rsvd; |
| const bool user; |
| |
| /* Derived from mmu and global state. */ |
| const bool is_tdp; |
| const bool nx_huge_page_workaround_enabled; |
| |
| /* |
| * Whether a >4KB mapping can be created or is forbidden due to NX |
| * hugepages. |
| */ |
| bool huge_page_disallowed; |
| |
| /* |
| * Maximum page size that can be created for this fault; input to |
| * FNAME(fetch), direct_map() and kvm_tdp_mmu_map(). |
| */ |
| u8 max_level; |
| |
| /* |
| * Page size that can be created based on the max_level and the |
| * page size used by the host mapping. |
| */ |
| u8 req_level; |
| |
| /* |
| * Page size that will be created based on the req_level and |
| * huge_page_disallowed. |
| */ |
| u8 goal_level; |
| |
| /* Shifted addr, or result of guest page table walk if addr is a gva. */ |
| gfn_t gfn; |
| |
| /* The memslot containing gfn. May be NULL. */ |
| struct kvm_memory_slot *slot; |
| |
| /* Outputs of kvm_faultin_pfn. */ |
| unsigned long mmu_seq; |
| kvm_pfn_t pfn; |
| hva_t hva; |
| bool map_writable; |
| |
| /* |
| * Indicates the guest is trying to write a gfn that contains one or |
| * more of the PTEs used to translate the write itself, i.e. the access |
| * is changing its own translation in the guest page tables. |
| */ |
| bool write_fault_to_shadow_pgtable; |
| }; |
| |
| int kvm_tdp_page_fault(struct kvm_vcpu *vcpu, struct kvm_page_fault *fault); |
| |
| /* |
| * Return values of handle_mmio_page_fault(), mmu.page_fault(), fast_page_fault(), |
| * and of course kvm_mmu_do_page_fault(). |
| * |
| * RET_PF_CONTINUE: So far, so good, keep handling the page fault. |
| * RET_PF_RETRY: let CPU fault again on the address. |
| * RET_PF_EMULATE: mmio page fault, emulate the instruction directly. |
| * RET_PF_INVALID: the spte is invalid, let the real page fault path update it. |
| * RET_PF_FIXED: The faulting entry has been fixed. |
| * RET_PF_SPURIOUS: The faulting entry was already fixed, e.g. by another vCPU. |
| * |
| * Any names added to this enum should be exported to userspace for use in |
| * tracepoints via TRACE_DEFINE_ENUM() in mmutrace.h |
| * |
| * Note, all values must be greater than or equal to zero so as not to encroach |
| * on -errno return values. Somewhat arbitrarily use '0' for CONTINUE, which |
| * will allow for efficient machine code when checking for CONTINUE, e.g. |
| * "TEST %rax, %rax, JNZ", as all "stop!" values are non-zero. |
| */ |
| enum { |
| RET_PF_CONTINUE = 0, |
| RET_PF_RETRY, |
| RET_PF_EMULATE, |
| RET_PF_INVALID, |
| RET_PF_FIXED, |
| RET_PF_SPURIOUS, |
| }; |
| |
| static inline int kvm_mmu_do_page_fault(struct kvm_vcpu *vcpu, gpa_t cr2_or_gpa, |
| u32 err, bool prefetch, int *emulation_type) |
| { |
| struct kvm_page_fault fault = { |
| .addr = cr2_or_gpa, |
| .error_code = err, |
| .exec = err & PFERR_FETCH_MASK, |
| .write = err & PFERR_WRITE_MASK, |
| .present = err & PFERR_PRESENT_MASK, |
| .rsvd = err & PFERR_RSVD_MASK, |
| .user = err & PFERR_USER_MASK, |
| .prefetch = prefetch, |
| .is_tdp = likely(vcpu->arch.mmu->page_fault == kvm_tdp_page_fault), |
| .nx_huge_page_workaround_enabled = |
| is_nx_huge_page_enabled(vcpu->kvm), |
| |
| .max_level = KVM_MAX_HUGEPAGE_LEVEL, |
| .req_level = PG_LEVEL_4K, |
| .goal_level = PG_LEVEL_4K, |
| }; |
| int r; |
| |
| if (vcpu->arch.mmu->root_role.direct) { |
| fault.gfn = fault.addr >> PAGE_SHIFT; |
| fault.slot = kvm_vcpu_gfn_to_memslot(vcpu, fault.gfn); |
| } |
| |
| /* |
| * Async #PF "faults", a.k.a. prefetch faults, are not faults from the |
| * guest perspective and have already been counted at the time of the |
| * original fault. |
| */ |
| if (!prefetch) |
| vcpu->stat.pf_taken++; |
| |
| if (IS_ENABLED(CONFIG_RETPOLINE) && fault.is_tdp) |
| r = kvm_tdp_page_fault(vcpu, &fault); |
| else |
| r = vcpu->arch.mmu->page_fault(vcpu, &fault); |
| |
| if (fault.write_fault_to_shadow_pgtable && emulation_type) |
| *emulation_type |= EMULTYPE_WRITE_PF_TO_SP; |
| |
| /* |
| * Similar to above, prefetch faults aren't truly spurious, and the |
| * async #PF path doesn't do emulation. Do count faults that are fixed |
| * by the async #PF handler though, otherwise they'll never be counted. |
| */ |
| if (r == RET_PF_FIXED) |
| vcpu->stat.pf_fixed++; |
| else if (prefetch) |
| ; |
| else if (r == RET_PF_EMULATE) |
| vcpu->stat.pf_emulate++; |
| else if (r == RET_PF_SPURIOUS) |
| vcpu->stat.pf_spurious++; |
| return r; |
| } |
| |
| int kvm_mmu_max_mapping_level(struct kvm *kvm, |
| const struct kvm_memory_slot *slot, gfn_t gfn, |
| int max_level); |
| void kvm_mmu_hugepage_adjust(struct kvm_vcpu *vcpu, struct kvm_page_fault *fault); |
| void disallowed_hugepage_adjust(struct kvm_page_fault *fault, u64 spte, int cur_level); |
| |
| void *mmu_memory_cache_alloc(struct kvm_mmu_memory_cache *mc); |
| |
| void track_possible_nx_huge_page(struct kvm *kvm, struct kvm_mmu_page *sp); |
| void untrack_possible_nx_huge_page(struct kvm *kvm, struct kvm_mmu_page *sp); |
| |
| #endif /* __KVM_X86_MMU_INTERNAL_H */ |